IPsec Policies same dst.address to different peer

Hello,

I want to add the same destination network ( remote LAN) to different peer, but the status is invalid, I can not add it. In the example, the network 10.251.0.0/16 is configured con peer 8, but I have to add it to all the other peer. I attach a photo of the current scenario.

Forget about IPsec for a moment and think where the real problem is. Let’s suppose it was possible to add the 10.251.0.0/16 to two distinct peers. Now state the criteria the router should use to decide to which one of those two peers to send a packet for 10.251.1.3.

The solution will depend on these criteria.

Hello,

I realized the trivial mistake I made, thanks for the reply :slight_smile:

Well, use cases where it would make sense actually do exist. Some of them could be resolved by using a multicast address, other ones by taking source addresses into account when choosing the route/gateway/peer. I have even met people who had valid reasons to connect multiple devices with exactly the same IP address to the same router and nevertheless them talk to some external devices independently, and even scuh a requirement does have a solution (but the solution used in that case would not work with bare IPsec).